Run CodeQL analysis (javascript) on a particular sub-directory in a repo

[vc-lijup-nandana]

I have a repo with many microservices each will have separate CI pipeline in the same repo. I need to scan each microservices separately, which are in separate directory.

I tried following code

name: 'CI - Demo Job - Bing'

on:
  workflow_dispatch:
  push:
    paths:
      - 'app1/services/microservice1'
   
jobs:
  sast:
    name: Static Application Security Testing (SAST)
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code into subdirectory
        uses: actions/checkout@v2
        with:
          fetch-depth: 0  # Fetch all history for accurate path filtering
          path: 'app1/services/microservice1'  # Specify the directory to checkout

      # Continue with your CodeQL setup and analysis steps
      - name: Initialize CodeQL
        uses: github/codeql-action/init@v2
        with:
          languages: javascript
          queries: security-extended,security-and-quality

      - name: Javascript Autobuild
        uses: github/codeql-action/autobuild@v2 

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v2
        with:
          category: "/language:javascript"

But this is scanning the entire repo and services not only limited to microservice1

[aeisenberg]

You need to create a code scanning configuration file and specify a paths option that tells CodeQL which paths to include in the database.

And then you also need to change the category: "/language:javascript" option so that it is unique to the subdirectory you are working on. See the docs on categories.

[Abdeltoto]

TL;DR — CodeQL is still looking at the wrong root. Point it at your microservice folder with source-root, and run autobuild from that same folder.

What went wrong
actions/checkout with path: only changes where the git checkout lands. It does not tell CodeQL “only analyze this subtree.” By default, CodeQL still treats $GITHUB_WORKSPACE as the project root — so you keep getting a database that feels like “the whole repo.”

What to do

1. Normal checkout (simplest): drop the odd path: unless you really need it. Stay at the repo root.

2. Tell CodeQL where the JS app lives — on github/codeql-action/init@v3 (or current v2), set:

   source-root: app1/services/microservice1
   (path is relative to $GITHUB_WORKSPACE, and should be the folder that contains that service’s package.json / real sources.)

3. Autobuild in the same place — either:

   • set defaults.run.working-directory: app1/services/microservice1 for the autobuild step, or
   • run your own npm ci / npm run build there between init and analyze.

4. Optional extra guard — add a codeql-config.yml with paths / paths-ignore so only that service’s tree is in scope (see CodeQL “customizing analysis” docs).

5. Bump the actions — use actions/checkout@v4 and github/codeql-action/*@v3 so you get current inputs and behaviour.

on.push.paths only controls when the workflow runs, not CodeQL’s analysis scope — easy mix-up.

If anything still looks “too wide”, paste the layout under $GITHUB_WORKSPACE from a failing run and we can nail the exact source-root path.